diff --git a/cmd/soju/main.go b/cmd/soju/main.go
index 5c5115f..1b1dacb 100644
--- a/cmd/soju/main.go
+++ b/cmd/soju/main.go
@@ -55,7 +55,10 @@ func main() {
 		if err != nil {
 			log.Fatalf("failed to load TLS certificate and key: %v", err)
 		}
-		tlsCfg = &tls.Config{Certificates: []tls.Certificate{cert}}
+		tlsCfg = &tls.Config{
+			NextProtos:   []string{"irc"},
+			Certificates: []tls.Certificate{cert},
+		}
 	}
 
 	srv := soju.NewServer(db)
diff --git a/upstream.go b/upstream.go
index 59cf827..46ce203 100644
--- a/upstream.go
+++ b/upstream.go
@@ -132,7 +132,7 @@ func connectToUpstream(network *network) (*upstreamConn, error) {
 
 		logger.Printf("connecting to TLS server at address %q", addr)
 
-		tlsConfig := &tls.Config{ServerName: host}
+		tlsConfig := &tls.Config{ServerName: host, NextProtos: []string{"irc"}}
 		if network.SASL.Mechanism == "EXTERNAL" {
 			if network.SASL.External.CertBlob == nil {
 				return nil, fmt.Errorf("missing certificate for authentication")